Method and system for paying with a portable data medium having security against over charging and unauthorized use

ABSTRACT

A data medium in the form of a check card is known. Such check cards include a memory in which at least one amount of money is stored. If the user wishes to purchase or use a product or service, the amount of money is debited by the vendor. If the vendor intents to defraud the user, or simply makes an unintentional error, too much money may be debited from the data medium without the user noticing immediately that this has occurred. This type of fraud or error may also occur when using other data mediums, including credit cards, debit cards, special purpose cards such as telephone cards and transportation cards, and the like. In order to avoid such fraud or error, further memories are provided in the data medium according to the present invention, wherein one internal memory serves solely for the purpose of accepting amounts of money from outside. With the aid of a small terminal which the user carries with him, together with the data medium, an amount corresponding to the cost of a product or service can, for example, be transmitted from the memory, which serves to accept amounts from outside, to an externally accessible memory. Since from outside, amounts can only be deducted from this externally accessible memory, it is impossible for erroneous or fraudulent amounts to be deducted from the data medium. Several externally accessible memories can be provided.

FIELD AND BACKGROUND OF THE INVENTION

The present invention relates to a method and system for paying vendorsfor goods and/or services by means of a portable data medium comprisinga memory and a control unit. Data are stored in the memory whichpreferably represent amounts of money or number of value units. In orderto write such data representing total amounts of money or unitsavailable, the user establishes an operative connection with a creditingterminal through a data carrier, for example the user's bank through aconnection via electrical contacts or in a contactless manner. Suchconnection can, for example, be via an electrical or other contactlessmeans. The terminal initiates a writing process and debits the accountof the user for the appropriate amount while crediting the user's datamedium. Examples of the data medium are check cards, debit cards, andthe like. This corresponds to withdrawing cash from the bank, with thedifference that the cash now is directly available to the user not inthe form of bank notes but as "electronic money". If the user wants toavail himself of a product from a vendor, for example for the purchaseof goods or the use of a service, the user establishes a connectionbetween his data medium and the vendor terminal. This can also takeplace via contacts or in a contactless manner. The vendor terminal thandebits the amount of money or value unit or units corresponding to thedesired product or service from the memory of the data medium andsimultaneously credits the account of the vendor with this amount,preferably transferring it to a memory in the vendor terminal. Thetransition of the electronic money can take place as anonymously as thehanding-over of bills, i.e. the memory of the vendor stores only theamounts of money, not however, information about the data medium fromwhich the individual amounts of money have originated. This anonymity isdue to the need for data security and privacy for the user.

When moving electronic money from the user's data medium into the memoryof the vendor terminal, the amount of the money or units which are to betransferred, must be indicated. This takes place conventionally throughfixed standard amounts, such as, for example, in vending machines orautomatic ticket machines or ticket cancelers or by entering the amount,for example, using keys on the vendor terminal, which is carried out bythe vendor. It is, in principle, possible for the vendor to enter ahigher amount than that authorized by the user or holder of the card ormedium, i.e. the customer. It is also possible for the terminal to bemanipulated by the vendor in such a way that a higher amount is actuallytransferred from the data medium than is, for example, displayed at thevendor terminal. This can not practically be checked by the user of thedata medium and subsequent proof is only possible in very involved ways.This causes uncertainties in the mind of the user when using the mediumand differs from the case in which a product is paid for with cash. Thisrepresents a significant disadvantage when using electronic money.

U.S. Pat. No. 4,859,837 discloses a portable data medium comprisingseveral separate memories from which amounts of money can be transferredto the outside with the memories being allocated to different accountsof the medium user. Transferring an amount of money to the outside is,however, only possible if previously a secret number has been enteredinto the medium by the user. Only one of the memories is not allocatedto an account and accessible from the outside without entering a secretnumber. This known medium comprises a battery and further a display unitand buttons with which a secret number and also an amount of money canbe entered in order to transfer this amount from one of the memoriesthat is protected by the secret number, to the outside or into theunsecured memory. Due to the battery, the display unit and the buttons,the data medium can hardly be as small as a check card or other likemedium. The data medium cannot be produced in a cost-effective manner,and the various possibilities of debiting from one of the memoriesrequires a cumbersome operation and a complicated control. German patentdocument DE 44 41 413 A1 describes a data exchange device with portabledata medium comprising a memory for storing an amount of money. Fromthis memory amounts of money can only be deducted after a secret numberhas previously been entered. Only payment of relatively small amounts ofmoney is possible without a secret number and the maximum sum of thedeductible relatively small amounts of money is defined. An unauthorizeduser who does not know the secret number can thus use only this maximumsum of money so that the damage is limited. The maximum sum, however, isdefined in the data medium so that it cannot be changed and formeaningful use it cannot be selected to be so low such that when anincorrect, e.g. higher amount is deducted, noticeable damage stilloccurs to the legitimate owner. The use of an additional money memory inthe medium, from which amounts of money can be deducted without a secretnumber thus, for various reasons, is not practical.

A system by the name MONDEX is known, in which a user has an electronicdevice in the approximate form of a wallet. The device comprises adisplay and a relatively large number of buttons as well as a memory. Inthis memory data representing amounts of money are stored. Theelectronic wallet further comprises a receiver for a portable datamedium in the form of a chip card which also includes a memory. Afterthe data medium is inserted into the receiver of the wallet, aselectable amount of money can be deducted from the memory of the devicethrough the actuation of buttons and transferred into the memory of thedata medium. The data medium can be used like cash if the vendor has acorresponding terminal with which amounts of money can be deducted fromthe data medium. If the wallet in which relatively large amounts can bestored, is, for security reasons, kept at a selected location, forexample in the home of the user or owner, a greater amount of money iscustomarily transferred into the data medium than is required for payingfor a single product. For that reason, this system represents anuncertainty for the user with respect to an erroneously or fraudulentlyacting vendor, just as in the case of a check card into which amounts ofmoney are directly transferred from a bank in the form of data. TheMONDEX system is furthermore cumbersome to handle.

SUMMARY OF THE INVENTION

It is the task of the present invention to provide a method and systemfor paying for products and/or services, which is simple in itsapplication and in which the same terminals can be used for deductingamounts of money or units, as is the case for known cards and otherknown mediums, with a money or credit memory. In this system the amountsof money or credits contained in the data medium are significantlybetter protected.

To achieve this task, a small pocket device (first terminal) with adisplay and keys is used with a data medium which does not include anyoperating keys or display elements and in which, exclusively, at leastone first memory or memory section is accessible from outside, while asecond memory or memory section can only accept amounts of money fromoutside. The second memory holds these amounts available and cantransfer them within the data medium, into the first memory or one ofthe first memories. This provides especially good protection for theamount of money or value units stored in the second memory. In thefollowing, this second memory is therefore also referred to as aninternal memory and the first memory as a further memory. To use as adata medium, e.g. a card in accordance with the ISO standards, the datamedium does not comprise any operating elements; thus transfer of themoney into the further memory takes place with the aid of a special userterminal, referred to in the following as a first terminal, which can,however, be very simply implemented and comprises preferably a batteryalso for the energy supply of the portable data medium. It is sufficientthat the first terminal can receive the data medium so far that aconnection can be established via contacts or in a contactless manner,and, in addition, only very few operating elements on the first terminalare required since it serves only few simple functions, namelyessentially to transfer data representing an amount of money or units tobe spent from one memory into another. When the data medium issubsequently inserted into the terminal of a vendor, the vendor terminalcan only deduct amounts of money needed or units from the further memoryand, if the user has previously only transferred the precise amount ofmoney needed into the further memory, it is therewith ensured that noamount of money greater than this is unintentionally or fraudulentlytransferred from the data medium. With the method according to theinvention, the user has the same certainty as is the case when payingwith cash, i.e. the user has direct control of how much money isdeducted or transferred from the data medium by the vendor. The vendoris thus paid so to speak, with counted money. For a terminal of a vendorthe data medium behaves in the same way as known data mediums that haveonly one memory, since control of the data medium according to theinvention permits access for the purpose of debiting only the accessibleor first memory.

It should be noted that in all cases in which the storage or transfer ofan amount of money is discussed, other value units are also meant, whichare stored or transferred as data. The quantities or the amounts ofmoney or value units can be derived directly from the data or throughany desired encryption via, for example, cryptological calculations andprotocols connected therewith.

Use of the data medium by an unauthorized person which has, for example,found or stolen the data medium, is in general prevented by knownmethods through the use of a PIN. However, the further memory isaccessible from outside without the use of a PIN. Therefore any amountavailable in a further memory can also be fraudulently deducted. In themethod according to the invention improper use can also be readilyprevented in that the only available amount is that amount that wastransferred by the user using the first terminal from the internalmemory into the accessible or further memory. For this purpose, forexample, in the user's first terminal and in the data medium,corresponding secret codes are stored and the transfer from the internalmemory into the further memory takes place only if a verification ofsuch code(s) is made in the data medium and possibly in the firstterminal as well. The transfer of the amount of money from the datamedium to the vendor terminal or to the account of the vendor can thentake place without further protection. The secret codes in the datamedium and in the first terminal can be generated in such a way thatboth elements are only given out together from a bank and the codes aresubsequently written in during the production of the two elements.Alternatively, when first using a new data medium with a new firstterminal, the code, validation information or first secret information,can automatically be transferred from the data medium into theterminal--or visa versa--and can be stored there directly or afterconversion via a secret algorithm. But this should only be possible onceand must at least in the data medium be blocked against a repetitionsince otherwise security against fraud in the event of loss or theft ofthe data medium is no longer provided only in the event that, forexample, an already assigned user terminal is lost and another firstterminal is to be assigned, can it be provided that a special code knownto the user and, for example, agreeing with his personal secret PIN, isentered and checked for correctness in the data medium and subsequentlyactivates the output of the code from the data medium to the new userterminal. To increase security the number of times this process isactivated is limited to a low value so that when the number of times thedata medium is connected to another first terminal is exceeded, no codeis any longer output from the data medium to the terminal.

In this disclosure, terms like "his", "he" and "himself" are meant toinclude "her", "she" and "herself". The term "product" includes goodsand services.

In principle it can be provided that the data mediums used in the methodaccording to the invention are constructed so that before the firstconnection of a data medium to a first terminal, the further memory iscoupled with the internal memory so that, in that case, the internalmemory is directly accessible. In the process the amount of moneycontained in the internal memory would not be protected unless access isonly permitted after entering a secret number. In each case, the datamedium responds to any second terminal always in the same way as aconventional data medium.

Entering an amount of money to be transferred from the internal memoryto the further memory can take place so that in the data medium an inputmemory is provided into which the desired amount of money is initiallyentered. Only following a confirmation signal of the first terminal isthis amount of money or are the corresponding data transferred from theinternal memory into the further memory. If an amount of money has beenentered via the first terminal, the data medium can be temporarilyseparated from the first terminal before entering the confirmationsignal. This permits the entry of the amount of money during a quietphase while, for the confirmation signal, only a very simple actuationof the first terminal is necessary and the amount of money entered inthe input memory is nevertheless protected against improper deductionuntil the confirmation signal is received.

Even more favorable is the use of an input memory if an amount of moneycan be entered into the input memory in the data medium by a secondterminal (e.g. the vendor terminal). This avoids possible errors inkeying in a number and allows the user to simply press an "OK" key ifthe amount displayed is correct. The customer who, for example, wishesto buy an item, establishes an operative connection between his datamedium and the vendor terminal, either via contacts or, even moreusefully, in a contactless manner via an electrical field, or othercontactless means and the amount of money displayed by the vendorterminal is written into the input memory of the data medium. This inputprocess can, for example, be initiated by a corresponding signal fromthe vendor terminal or it can automatically be effected by the vendorterminal in that the further memory is found to be empty or notsufficiently filled. The vendor terminal will read that the input memoryis empty or at least is not sufficiently full for payment to the vendorterminal. The customer, i.e. the user of the data medium, nowestablishes contact between his data medium and his user terminal andreads on its display unit the amount of money indicated by the vendorterminal. If the user agrees with this amount, he enters theconfirmation signal and only then is this amount of money transferredfrom the internal memory into the further accessible memory, and onlythis amount of money can subsequently be deducted by the vendorterminal, preferably through a further connection of the data medium tothe vendor terminal via contacts. The procedures taking place are verysimple and fast, at least as fast as payment with cash and the customeris certain of the amount of money actually transferred to the vendorwith the entire payment procedure remaining entirely anonymous.

Instead of establishing contact of the data medium with the vendorterminal, it is also possible for the data medium to actively transferthe amount of money in a contactless manner, from a further memory intothe vendor terminal. Since the data medium itself has no separate energysource, and fields emitted from the vendor terminal are not sufficientin most instances to provide the data medium with sufficient energy foran active transmission, the data medium can, during its connection withthe user's first terminal, which does have its own energy source, andcan then provide also the data medium with energy and while the datamedium is in the proximity of the vendor terminal and, for example, byentering a further signal by the user, effect the transfer of the amountof money contained in the further memory to the vendor terminal. In theprocess, the customer, i.e. the user of the data medium, has completecontrol not only of the amount of the money, but also of the point intime at which it is transferred.

Under certain conditions the payment procedure can be furthersimplified, in particular if the vendor terminal is an automatic vendingmachine, for example an automatic beverage machine. In this case thevendor terminal, i.e. the automatic vending machine, can be equipped sothat it outputs an identification signal if a data medium is introducedor is brought into appropriate proximity. The identification signalcharacterizes the type of automatic machine, for example, candy vendingmachine or coffee vending machine, whereby simultaneously a given fixedamount of money for the goods of the automatic vending machine isdefined. The data medium subsequently transfers this amount of moneyinto the further memory without, in this special case, the customerneeding to use his user terminal or entering a confirmation signal. Thisamount of money is subsequently automatically deducted from the furthermemory through the vending machine. The amount of money transferable inthis way by the vending machine can be limited within the data medium toa low value so that the damage to the customer remains small in theevent of a malfunction or through fraudulent manipulation a wrongidentification signal is output by the vending machine and thereby ahigher amount of money is deducted from the data medium than correspondsto the cost of the goods delivered by the vending machine.

A small number of vendors exist whose products are frequently used bymany users. These are in particular telephone services, publictransportation means, parking places subject to fees, and similarproducts. With such vendors the danger that erroneously or evenfraudulently high amounts of money are deducted, is extremely low.Furthermore, such secure vendors frequently do not wish that eachterminal associated with this vendor is provided with a memory in whichthe electronically transferred amounts of money are collected. Accordingto one embodiment of the invention, therefore several further memorysections are provided into which are written greater amounts than arerequired for a one-time use of a particular product, wherein each memorysection is associated with a particular vendor. When a user availshimself of a product, the amount of money is automatically deducted onlyin the associated memory section through the terminal of the securevendor by a corresponding amount without data representing this amountbeing transferred from the data medium to the terminal. So that theparticular vendor is nevertheless credited with an amount of money, adata set is generated in the data medium during the transfer of arelatively large amount of money from the memory into a particularfurther memory section and stored in a third memory section which isread out at the latest when again amounts of money are transferred fromthe account of the user into the data medium, e.g., at the bank or whenin connection with a telephone system.

Even more favorable to particular vendors is the use of several furthermemory sections. In these further memory sections the amounts of moneyare stored in the form of value units. If a product of such a vendor isused, only one value unit or a corresponding number of value units isinvalidated in the corresponding further memory section. For thispurpose even less expenditures are required than is the case whendecreasing a stored amount of money by a particular amount correspondingto the product of which the user has availed himself.

In particular when using public transportation, the associated vendingmachine (second terminal) issues tickets for the subtracted amounts orthe invalidated value units. These separate tickets can be avoided iffurther memories are additionally provided in the data medium, intowhich the subtracted amounts or the invalidated value units aretransferred, preferably through the vending machines of thetransportation system. Moreover, through this vending machine or whenpassing through a barrier at the entrance to the transportation station,time of day information and information regarding the access location iswritten into the particular additional further memory. The data mediumitself serves in this way as a travel pass since the additional furthermemory contains all necessary specifications of a travel pass and can bechecked at any time during the trip. In the case of transportationsystems which check the travel passes at the destination exit, thecontent of the additional further memory can then be deleted. If at theexit no check is provided, the contents of the memory, serving as atravel pass, becomes automatically invalid due to elapsed time withoutneeding to be deleted. At the next use of the public transportationsystem, the associated additional further memory is simply overwritten.

The data medium can be issued by the bank at which the user has anaccount such that the memory of the data medium which is not accessiblefrom outside is loaded with a particular relatively large amount ofmoney, and when this amount of money is exhausted, the data medium isreturned to the bank. However, it is considerably more favorable if thememory of the data medium can be repeatedly replenished by the user withfurther amounts of money. For this purpose, the user connects the datamedium to a third terminal which is disposed, for example, in theoffices of his bank and during the transfer of money the correspondingdata are automatically transferred into the computer of the bank and theamount of money transferred to the data medium is deducted from theaccount of the user. Simultaneously the contents of the third memorysection is automatically, i.e. without any activity on the part of theuser, read out and transferred into the computer. These read data of thethird memory section are used such that the amount of money which hasbeen transferred by the user into the further memory section allocatedto a particular vendor, is now also credited to this vendor. This thirdterminal for replenishing the memory of the data medium need not bedisposed only in the offices of the user's bank but it is alsoconceivable that it can be accessed via a public or private telephoneconnection which, in known manner, can be used with a chip card. Throughthe appropriate operation of such card telephone, all of the dataaccompanying the replenishment of the data medium, such as the amount ofmoney, designation of the bank, of the user and his account number, canbe transferred via a computer of the telephone company or directly tothe user's bank. This permits the user to be largely independent of thelocation of his bank and its branch offices since in most instances acard telephone is probably closer to the location of the user.

According to a further embodiment of the invention, the transfer ofmoney from the internal memory of the data medium, which is loaded forexample in the above described way, into a further memory sectionallocated to a particular vendor, can be carried out not only throughthe first terminal but also through the third terminal, i.e. preferablythrough a card telephone by means of a corresponding operation. In theprocess, no data specifying this transfer needs to be transferred intothe third memory section of the data medium and placed there forintermediate storage; rather, these data can be transferred immediatelyvia the third terminal, for example, directly to the computer of thevendor to whom the particular further memory section is allocated. Theuse of the third terminal is in particular necessary if a further memorysection is to be allocated for the first time to a vendor or to adifferent vendor from a previously allocated vendor.

It can occur that the products of a vendor, to whom a particular furthermemory section is allocated, are not to be used for at least arelatively long time. This is the case, for example, if the vendor isthe public transportation provider of a city and the user is absent fromthis city for a relatively long period of time. If, in the furthermemory section allocated to this vendor, money or value units are stillstored, these would not be currently available to the user. In order tobe nevertheless able to use such money, a further embodiment of theinvention provides that the amounts of money or value units stored insuch further memory section can again be transferred back to theinternal money memory. This can take place with the aid of a thirdterminal, thus preferably with the aid of a card telephone, and thecorresponding data must be relayed via this terminal so that this amountof money is again deducted from the vendor to whom the particularfurther memory section is allocated from which money is to betransferred back. This is necessary since, in general, the vendor hadbeen credited with the entire amount which had previously beentransferred to the further memory section allocated to that vendor. Ifthe transfer from such further memory section back into the internalmoney memory takes place by means of the first terminal of the userhimself, corresponding data identifying this procedure must betransferred into the third memory section so that the re-crediting ofthe amount, transferred back within the data medium from a furthermemory section into the internal money memory, can be carried out fromthe account of the allocated vendor when the data medium is connectedthe next time to a third terminal.

If from a further memory section an amount of money has been transferredback into the internal money memory, this amount can be transferredagain into a further memory section allocated to another vendor.

The individual further memory sections, or at least a portion thereof,can be fixedly allocated to specific vendors; for example, one furthermemory section is provided for telephone value units, another furthermemory section for parking fees and a third further memory section forproviders of public passenger transportation. Further memory sectionscan also be provided which can be optionally allocated to specificvendors, for example by way of specific code numbers assigned to thevendors, which code numbers can be selected by the user. However, withfixedly allocated further memory sections, the use, i.e. deduction ofvalue units, is significantly simpler. For specific services, forexample for public transportation or parking fees, various vendors ofthe same type of services exist which have divisional accounting, forexample public transportation in different cities or regions. In thecase of the fixed allocation of at least a portion of the further memorysection to specific vendors, it is useful for this allocation to be fora specific type of services, i.e. a specific further memory section isfor instance always allocated to public transportation. But, in order tobe able to differentiate between the various vendors of the same type ofservices, the amounts of money or value units of the particular furthermemory section is provided with an identifier which indicates whichspecific vendor, i.e. in the example of public transportation, whichcity or region is associated with the value units contained in theparticular further memory section. This identifier can be, for example,the postal zone code or the telephone area code of this city or regionor a portion of these numbers. In order to select such specific vendor,the data medium is connected to a third terminal, i.e. preferably to acard telephone, and through appropriate operation a selectable amount ofmoney is transferred into the particular further memory section togetherwith the identifier assigned to the specific vendor. Simultaneously,corresponding data are transferred via the card telephone into acomputer whereby this selected vendor receives a credit note about theamount of money which the value units written into the further memoryrepresent.

The identifier need not be input by the user if a particular identifierfor a specific vendor will be assumed based upon the region of operationof this specific vendor in which the connection has been made. If afurther memory section already exists for that specific vendor in thatregion, an amount of money or number of value units will be stored inthat further memory. If no such further memory exists, a new furthermemory will be created for that specific vendor and the appropriateidentifier associated with that new further memory section. The amountof money or number of value units are then stored in the newly createdfurther memory section. If a user wishes to remotely select a particularspecial vendor in a different region, the user inputs, via a thirdterminal, the identifier for that selected specific vendor in that otherregion, and thereafter, the amount of money or number of value units arestored in the corresponding further memory section or in a newly createdcorresponding further memory section, while the amount is credited tothe account of that selected specific vendor in that other region.

If a vendor or a type of product is used only rarely or only once andif, after the last use, value units still remain, the user could forgetthat these value units are still available without being able to disposeof them immediately. For this reason, further identifiers representing adate, are assigned to the value units or amounts of money of at leastsome of the further memory sections. This date is compared, during everyconnection of the data medium to a third terminal, with the currentdate, and if this difference exceeds a given value, it can be assumedthat the user at least temporarily will no longer use the associatedproduct in the future, and the amounts of money or value units containedin this further memory section are automatically transferred back intothe internal money memory as amounts of money. In this case thesecorresponding data are also transferred from the third terminal to acomputer and these value units or amounts of money which had alreadybeen credited to a specific vendor, are again deducted from that vendor.

The invention relates further to a system for carrying out the methodaccording to the invention with at least one portable data medium andseveral terminals which are equipped for carrying out the methodaccording to the invention.

The invention further relates to portable data mediums that have amemory and a control unit suitable for carrying out the method accordingto the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

In the following, embodiments of the invention will be explained infurther detail in conjunction with the drawing, wherein:

FIG. 1 is a schematic diagram illustrating the connection of a portabledata medium to a terminal for transferring an amount of money into thedata medium;

FIG. 2 is a schematic diagram illustrating the transfer of amounts ofmoney or value units within the data medium to various memory sectionsin the data medium;

FIG. 3 is a schematic diagram illustrating the erasing of value units inone of the memory sections through a terminal of a vendor;

FIG. 4 is a schematic diagram illustrating the connection of data mediumto a terminal which is connected to a computer for transferring valueunits or amounts of money into a memory section;

FIG. 5 is a schematic diagram illustrating the connection of data mediumto a terminal to transfer back value units from a memory section intothe internal money memory;

FIG. 6 is a schematic diagram illustrating two memory sectionscontaining partially decremented value units and which are provided withan identification; and

FIG. 7 is a perspective view of an embodiment of a personal terminalwith data medium according to the invention; and

FIG. 8 is a schematic diagram illustrating another feature of theinvention.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

FIG. 1 schematically illustrates portable data medium 20 containing orcarrying a number of memories or memory sections 23 and 25 to 28 as wellas a control unit 21. The elements of the data medium 20 are connectedto the outside via an interface 29 which here, for the sake of clarity,is shown with several lines. Data which preferably represent amounts ofmoney can be exchanged with the memory 23 via a line 11. Controlcommands are sent to the control unit 21 via a line 12, and via a line16 the contents of the memory 28 can be read out. The individualmemories preferably represent memory sections of at least one uniformmemory. Lines 11, 12 and 16 of the interface 29 as well as furtherlines, not shown, in particular for a voltage supply, in fact, do notneed to be present as separate lines. Rather, several lines can becombined to one multiplex line if a data medium with several electricalcontacts is assumed. In the case of a data medium for contactless dataand energy transmission, all lines are preferably realized throughinductive or capacitive coupling.

In FIG. 1 the data medium 20 is connected to a terminal 3, indicatedschematically, which is realized, for example, by a card telephone andis connected via a connection 18 to a computer 19. This computer canalso be realized by a general data processing arrangement or also by anaccounting device. This connection is temporarily established by theuser. The terminal 3 essentially comprises a display unit 4, a keyboard5 and a control unit 6. Specific operation of the keyboard 5 activatesthe control unit 6 to transmit via connection 12, control commands tothe control unit 21 of the data medium 20, whereupon it selects, via aconnection 22, the memory 23 in order to exchange data representingamounts of money. In addition, memory 28 is selected to transfer itscontents via line 16 to terminal 3. The amount of money or thecorresponding data which are written into memory 23 are determined bythe user by means of entry via keyboard 5 and output by the control unit6 of the terminal 3 onto line 11. The display unit 4 serves to displaythe entered data or for the display of messages from which the user canrecognize the particular following required operation. The datatransferred via line 16 from the data medium to terminal 3 is processedby the control unit 6, and data derived therefrom as well as data formedfrom the transfer into memory 23 are sent via line 18 to the computer19. These data sent to computer 19 cause the corresponding amount ofmoney, which had been supplied to the data medium 20, to be deductedfrom the account of the owner of the data medium 20, and, in addition,the data read from memory 28 are processed. The significance of thesedata will be explained later.

In FIG. 2 the data medium 20 is coupled to a terminal 1, which includesa display unit 8 as well as some keys 9, but only an extremely simplecontrol unit 7. This terminal 1 can therefore be implemented so as to bevery small, in particular, it only needs to be the size of a fraction ofthe area of the data medium 20 and specifically just large enough sothat the contacts or the inductive coupling arrangement of the datamedium can be accepted. This terminal can be fixedly assigned to theuser. Terminal 1 is equipped with its own voltage supply in the form ofa small battery. Through appropriate actuation of keys 9, and viaconnection 12 of the interface 29 the control unit 21 in the data medium20 is selected in order to initiate the transfer of an amount of moneydetermined for example through the contents of an input memory 21b fromthe memory 23 into a selectable memory section 25, 26 or 27. Thespecification for an amount of money selected via keys 9 of terminal 1,can be transferred via the connection 12a, shown here separately, intothe input memory 21b. Furthermore, the amount of money selected via keys9 is displayed on the display unit 8 directly or, after transfer intothe input memory 21b through retransfer via connection 12a, as thecontents of the input memory.

Before the transfer of the selected amount of money to data medium 20,first, a secret number can be transferred from a memory 7a in terminal 1to the data medium 20 and supplied to a comparator 21a which comprises amemory in which also a secret number can be stored. The secret numbercan additionally also be encrypted or decrypted by the control units 7or 21, respectively. Under specific conditions, in particular whenconnecting the data medium 20 to terminal 1 for the first time, thesecret number can be transferred from the terminal into the data mediumand directly or as a secret number derived from the terminal to bestored in the data medium. The comparator 21a subsequently checkswhether or not the two secret numbers have a given relationship,preferably whether or not they are identical, during later repeatconnections. Only if this is the case would the control unit be enabledin order to process subsequent amounts of money to be transferred intoinput memory 21b using terminal 1. This would further allow such amountsof money to be transferred from memory 23 to a selected memory section25, 26 or 27.

This takes place within data medium 20 via the control connection 22depicted schematically, which leads to memory 23 and to the memorysections 25 to 27 and which selects one of them. By selecting memory 23the data corresponding to the desired amount of money are transferredvia line 24 to the selected memory sections 25 to 27 and transferredinto some of these memory sections preferably in the form of valueunits. Simultaneously, via control connection 22 memory 28 is selected,and to it the data output from memory 23 corresponding to thetransferred amount of money are supplied and written into it. However,this is only the case if the selected memory section is fixedlyallocated to a vendor. If a product of this vendor is to be used, only acorresponding amount of money is subtracted from the particular memorysection or a corresponding number of value units are invalidated in thememory section. Corresponding data are changed in the memory section,however, neither the amount of money nor the value units are actuallytransferred to the vendor. Consequently, in such a case no money istransferred to a memory of the vendor. However, in order for the vendorto be nevertheless credited with the amount of money which wastransferred into the allocated memory section, this amount is placedinto intermediate storage in memory 28 and, the next time the datamedium is connected preferably by a card telephone, the intermediatememory is read out via line 16, as explained in conjunction with FIG. 1.If, in contrast, the amount of money is transferred into a memorysection from which a vendor transfers an amount of money directly intohis own memory, intermediate storage is not required when transferringmoney from memory 23 to this vendor memory section.

Referring to FIG. 4, another operation which can be achieved accordingto the present invention is the use of the first terminal to load aselected amount of money or selected number of credit units from thesecond memory 23 to one of the special vendor memories 25, 26 or 27. Atthe same time data is stored in third memory 28, corresponding to theamount of money or number of units loaded into the special vendormemory. Before utilizing the money or units, the user must connect thedata medium 20 to a third terminal, for example, a card telephone 3shown in FIG. 4, whereupon appropriate operations transfer the data fromthird memory 28 corresponding to the amount of money or units in thevendor memory, to the central computer 19, through the third terminal 3,thereby crediting that vendor. A signal either from the third terminalor from the computer or from the control unit of the data medium,validates and permits future use of the money or credits loaded into thevendor memory, when the data medium is thereafter attached to a specialvendor terminal.

The control unit 21 must thus control a sequence of functions and, withdifferent applications such as the connection to terminal 3 in FIG. 1,control different sequences of functions so that the control unit 21 isusefully implemented as a program-driven microprocessor with associatedprogram memories. This comprises a number of sub-programs which areassigned to the different sequences of functions. Subsequently, throughthe control commands transferred from a terminal fixedly assignedsub-programs are called up so that the control commands can be verysimple and in particular the terminal 1 needs only to be constructed tobe correspondingly simple so that the actuation of a particular key isnearly directly only assigned to a specific control command. Thefunction procedure initiated by actuating a specific key is thusdetermined exclusively through the program in the data medium. It isthereby possible to operate different data mediums that are assigned,for example, to different vendors or groups of vendors, with the sameterminal and the actuation of the same key in different data mediums canenable different functions. It is favorable if the display 8 of terminal1 is driven by the data medium at the time it is connected so that theuser recognizes from the displayed information which type of data mediumhe is currently using. It is readily possible to assign to the same keyof the terminal, sequentially different functions. For example, at thestart, after connection with data medium is established, a key can bepressed to select a specific vendor. After this selection, an amount ofmoney can be selected with the same key, etc. This is possible bydisplaying the assignment of the key on the display, and through thecorresponding mechanical structure of the terminal, as will be explainedlater in further detail.

FIG. 3 schematically shows the case in which the user wants to availhimself of a product and connects the data medium 20 to a vendorterminal 2. This terminal 2 is shown entirely schematically with onlyone processing unit 10; further elements, such as a possible displayunit and keyboard, have been omitted for the sake of clarity. Ifterminal 2 belongs to a vendor to which a memory section is fixedlyallocated, for example a public transportation operation, terminal 2transfers only control signals via line 12 to the control unit 21,through which preferably value units in the allocated memory section areinvalidated. If, however, it is any vendor who would like to transfer aspecific amount of money from the data medium 20, the control unit 21 iscorrespondingly selected and subtracts this amount of money from theamount of money available in the memory section which is provided forsuch optional vendors, for example, that available in memory section 27,and the control unit 21 transfers this amount of money via connection 12to terminal 2, as is indicated through the corresponding arrow ofconnection 12. Access to the memory 23, in general comprising a greateramount of money, is not possible due to the corresponding structure ofthe data medium, in particular of control unit 21.

In order to prevent an unintentionally or fraudulently high amount ofmoney from being transferred to terminal 2, only that amount of money isusefully contained in memory section 27 which has been authorized by theuser of the data medium, for example, by having previously, through thecorresponding operation of user terminal 1, transferred only the desiredamount of money from memory 23 to the memory section 27, as has beendescribed in conjunction with FIG. 2. A still simpler possibility foruse resides in that first the data medium 20 is connected to terminal 2,either via contacts or, more favorably, in a contactless manner in orderto transfer from terminal 2 via a connection 12a the desired amount ofmoney into the input memory 21b. This can be initiated by operating theterminal 2 or automatically in that the memory section 27, from whichthe terminal 2 seeks to deduct the amount of money, is empty or containstoo low an amount of money. After the input memory 21b has been written,the user of the data medium 20 connects it to user terminal 1, as wasdescribed in conjunction with FIG. 2, and the amount of money specifiedby the input memory is displayed on the display unit 8 of theterminal 1. By entering a simple confirmation signal the amount of moneyspecified by the input memory is transferred from memory 23 into memorysection 27. The user subsequently connects the data medium 20 again withterminal 2 after separating the data medium from terminal 1, so that viacontacts a connection can be established. Another possibility resides inthat the user does not separate the data medium from terminal 1 butbrings the medium and terminal together into the proximity of terminal2, and the data medium 20 actively transfers the amount of moneycontained in memory section 27 to terminal 2 contactlessly and with theaid of the battery in terminal 1. If the data medium 20 is itselfequipped with a battery, the terminal 1 can also be omitted forcontactless transfers.

With specific terminals 2, namely if these are automatic vendingmachines such as for candy or drinks, an exception can be made from theprinciple that a terminal 2 has not even indirect access to memory 23.If the data medium 20 is connected to such a terminal 2 and does notcontain a sufficient amount of money in memory section 27, terminal 2transfers an identification signal via the connection 12 to the datamedium 20, and the control unit 21 thereupon initiates the transfer of aspecific amount of money determined by the identification signal frommemory 23 into memory section 27, as is indicated by the dashed lines 22and 24, and now the terminal 2 can transfer this amount of money fromdata medium 20 and can deliver the goods. Since the maximum amount ofmoney allowed to be transferred is determined by the control unit 21 ofdata medium 20 and such amount of money for such automatic vendingmachines are only small, the user can incur only slight losses even inthe event of a potential error.

FIG. 4 schematically shows the way in which an amount of money istransferred from memory 23 of the data medium 20 into one of theselectable memory sections 25 to 27 with the aid of a terminal 3,realized by a card telephone or like device. Upon the correspondingoperation of the keyboard 5, the control unit 6 of terminal 3 generatescontrol data which are transmitted via connection 12 to the control unit21 of the data medium 20. As was described in conjunction with FIG. 2,the control unit 21 similarly selects, via connection 22 the memory 23and one of the memory sections 25 to 27. From memory 23 via theconnection 24 within the data medium 20, the desired amount of moneycorresponding to the data transferred via connection 12, is transferredinto the memory section 25 to 27 selected. It is not required in thiscase that this transfer is written into memory 28 since thecorresponding data can be directly transferred from terminal 3 viaconnection 18 to the computer 19, or the corresponding amount of moneyis transferred from the data medium 20 via the connection 14, shown indashed lines, to terminal 3 in order to form therein the correspondingdata for transfer to the computer 19.

From the control unit 21 via connection 22 the memory 28 is additionallyselected and its contents transferred via line 16 to terminal 3. It ispossible that since the last connection of the data medium 20 to aterminal 3, a transfer within the data medium had taken place with theaid of terminal 1, as has been described in conjunction with FIG. 2, andcorresponding data have been written into memory 28. The data in memory28 are deleted as soon as they have been read out via line 16.

In certain cases where the special vendor, whether it is atransportation authority, parking authority or other special vendor,does not wish to permit the user to use the vendors services until afterthe vendor has received advanced payment, the user can use terminal oneto allocate amounts of money or credit units to the special vendor, forexample by storing the required information in a portion of memory 28.At this point, the data medium may not yet be used for the particularservice. The next time the data medium is connected to the thirdterminal three, the data concerning crediting of the special vendor istransferred from memory 28 over line 16 and through the terminal three,to computer 19 which can then be used to credit the special vendor withthe amount of money or number of credit units which were previouslystored by the user in memory 28. This releases this amount of money or anumber of credit units to the special vendor's account and at the sametime loads a further memory section corresponding to that selectedvendor with the same amount of money or same number of value units.Thereafter, the data medium can be used with the terminal of thatspecial vendor to utilize the services of that vendor.

Although in the drawings, a single second memory or memory section 23has been shown, which is connected to at least one first memory ormemory section, it should be understood that the invention includes thepossibility of having more than one second memory each with its set offirst memory sections, on a single data medium.

FIG. 5 schematically depicts the way in which money or value units aretransferred back from one of the selection memory sections 25 to 27 intomemory 23. This can take place with the aid of a terminal 3, i.e. of acard telephone with a display unit 4, shown schematically, and akeyboard 5 as well as a processing unit 6, or also by means of aterminal 1 with a display unit 8, also shown schematically, a keyboard 9and a processing unit 7. The comparator 21 as shown in FIG. 2 is hereomitted since it is not required for this procedure. Through appropriateoperation of the keyboard 5 or 9, respectively, appropriate controlsignals are transmitted via line 12 to the control unit 21 of the datamedium 20. This selects correspondingly via connection 22 the memory 23and one of the memory sections 25 to 27, and via the connection 24a dataare now transferred to memory 23 and written into it. If this transfertakes place through terminal 1, the corresponding data which indicatethe transfer must be written into memory 28 as is indicated by thedashed line. On the other hand, if this transfer had been initiated viaa terminal corresponding to a card telephone, no corresponding dataneeds to be written into memory 28 since these data can be generated bythe processing unit 6 which, through appropriate control commands vialine 12 has initiated the corresponding transfer procedure in the datamedium 20. A simpler control potentially results if the data aretransferred in each case into memory 28, since this memory is read outvia the connection 16 depicted by dashed lines, when the data medium 20is connected with a card telephone.

FIG. 6 schematically indicates the contents of two memory sections 25and 26. It is assumed for the sake of simplicity that the memories donot contain amounts of money but rather value units. Both memorysections 25 and 26 contain in this example sixteen value units. It isunderstood that in practice the actual number can be greater. Amounts ofmoney or value units may actually be stored in the memories in the formof coded information. Each value unit is depicted by a square field.Fields containing an x represent exhausted value units while the fieldsdenoted by o represent value units which have not yet been exhausted.The memory section 25 further contains a field 31, and the memorysection 26 contains a field 32, and in these fields are containedidentifiers which apply to the entire memory. In particular, this fieldindicates the vendor to whom the particular memory is allocated. If thedata medium is connected to the terminal of a vendor, a validation isfirst carried out to determine whether or not one of the memoriescontains in its identification field, the identifier for the particularvendor. If this is not the case, the desired product is not approved.

Fields 31 and 32 can contain further identifiers, however, in particularthe specification of a date. This is preferably the date on which achange was carried out last in the memory, thus for example a value unitwas invalidated or new value units were written in. If the data medium20, as is for example shown in FIG. 7, is connected to a terminal 3,this terminal transfers also the current date to the control unit 21. Ifthe difference between this current data and the data contained in field31 or 32 exceeds a given value, the control unit 21 can initiatespecific processes. The control unit 21 can, for example, read out theremaining value units contained in such memory with a sufficiently longexpired date and transfer them as amount of money into memory 23. Thisbuilds on the assumption that a user, who has not availed himself ofproducts of a specific vendor for a relatively long time, will probablynot do so in the near future so that he can subsequently again freelydispose of the remaining credit balance for such vendor.

FIG. 7 depicts a concrete embodiment of a user terminal 1 with which itis possible to transfer amounts of money or value units from an internalmemory into an externally accessible further memory. This terminal 1 hasan elongated shape and comprises a display unit 8 as well as four keys 9and a further key 9a. Further, a slot 34 is provided into which datamedium 20 can be introduced which has the customary format of a credit,debit, special purpose or check card. Terminal 1 further comprises anenergy source in the form of a battery, which is not shown, and can bedisposed in the lower region of the unit. The keys 9 here carry nodesignation, instead designations 33 are printed onto the data medium 20which, after introduction of the data medium 20 into terminal 1, come tolie adjacent keys 9. The designation or the symbol, respectively, in theupper field indicates a telephone, and via the adjacent keys 9 one orseveral blocks of value units can be transferred from the internalmemory of data media 20 into a further memory from which, when using acard telephone, value units are deducted or invalidated.Correspondingly, the designation in the next field indicates that withthe associated key value units can be written into a further memory inorder to pay fees for using a parking space. The designation in thethird field indicates that the adjacent key serves for the purpose ofloading a further memory in the data medium in which, when using publictransportation, value units are invalidated.

With the aid of key 9a various functions can be controlled. Mainly key9a is pressed to send the confirmation signal but it can be used forother functions, for example, re-crediting value units or thecorresponding amount of money into the internal memory of data medium 20upon the additional actuation of the corresponding key 9.

Since keys 9 are not provided with a designation, but rather thesedesignations are applied on the data medium 20, it is possible with theaid of terminal 1 to use various types of data medium 20 with memoriesfor various types of products of various vendors with the same terminal.

FIG. 8 illustrates another feature of the invention which includes adata medium or card 20 having a chip 40 containing for example, acontrol unit in the form of a microprocessor and one or more memoriesaccording to the invention or according to the prior art. Chip 40includes a pair of contacts 42 and 44 which are normally used togalvanically engage contacts in a second terminal, which may be a vendorterminal, an automatic teller machine for a bank, or any other type ofmechanism which is capable of interacting with the chip 40. Data medium20 also carries an antenna loop 46 or other contactless means whichpermits communication with the chip in a contactless way. These types ofcontactless engagements are known and include a close coupling where thecard is brought into physical contact with a surface. Loop or othermeans 46 also permit operation through a loose coupling, for example,simply by waiving the card through a specified area. It is known thatmicroprocessors currently available which have a chip 40, must have aminimum amount of power to operate. The operations of the microprocessorcan be divided into active processes which require higher energy andpassive operations that can operate on very low energy. An example of apassive process is the reading of a memory, while an example of anactive process is the changing of the contents of a memory. It is knownthat with current technology, chip 40 can only be powered sufficientlyfor active operations by use of galvanic contacts 42 and 44 or, in somecases, by a close coupling through the contactless loop 46. Only passiveprocesses are possible if loose coupling is used through loop 46 sincethere is insufficient energy available to operate the active processesthrough the loose coupling. According to the invention, a first terminal36 can be provided which has a battery 38 or other onboard power supplyand which also includes contacts for galvanically connecting to contacts42 and 44 of chip 40. The purpose of first terminal 36 is solely topower chip 40 so that it can operate active processes even whencommunication between the data medium 20 and the vendor terminal orother appropriate terminal is solely through the loose coupling of loop46. The main object of this aspect of the invention is to permit the useof loose coupling for a data medium while active power consumingoperations can still be achieved in chip 40 through the use of the firstterminal 36 which is engaged to the data medium, for example byinserting an edge of the data medium adjacent the contacts 42, 44 into aslot in the terminal 36. The first terminal 1 in FIG. 2 can also be usedfor powering the card in this way.

While a specific embodiment of the invention has been shown anddescribed in detail to illustrate the application of the principles ofthe invention, it will be understood that the invention may be embodiedotherwise without departing from such principles.

What is claimed is:
 1. A method for paying for products including goodsand services of vendors, by means of a portable data medium having amemory with a plurality of memory sections, the methodcomprising:providing at least one first memory section and a secondmemory section for receiving data representing an amount of money;operatively connecting the data medium to a first terminal; using thefirst terminal to deduct, as a function of a first operation of thefirst terminal, a selected amount of money from the second memorysection and to write the selected amount into the at least one firstmemory section; for receiving a product of a vendor, operativelyconnecting the data medium to a second terminal and deducting only fromthe at least one first memory section, the selected amount of money;providing an unique, irreversible and checkable relationship between thedata medium and the first terminal by storing in the data medium a firstsecret information, and by storing in the first terminal a second secretinformation; transferring the second secret information from the firstterminal into the data medium; determining in the data medium that arelationship between the first and second secret information exists;thereafter permitting the selected amount to be deducted from the secondmemory section and written into the at least one first memory section;and only during a first initial connection of the data medium to a firstterminal, transmitting the first secret information to the firstterminal, and creating the second secret information in the firstterminal for a first time.
 2. A method as stated in claim 1, includingtransmitting the first secret information only if previously a furthersecret information is entered into the first terminal.
 3. A method asstated in claim 1, wherein, during a subsequent connection of a datamedium with another first terminal, following the first initialconnection of the data medium with the first-mentioned first terminal,the first secret information is only transferred from the data medium ifpreviously a further secret information is entered, and after a selectednumber of times that the data medium is connected to other firstterminals and the further secret information is entered, the firstsecret information is no longer transferred at all.
 4. A method forpaying for products including goods and services of vendors, by means ofa portable data medium having a memory with a plurality of memorysections, the method comprising:providing at least one first memorysection and a second memory section for receiving data representing anamount of money; operatively connecting the data medium to a firstterminal; using the first terminal to deduct, as a function of a firstoperation of the first terminal, a selected amount of money from thesecond memory section and to write the selected amount into the at leastone first memory section; for receiving a product of a vendor,operatively connecting the data medium to a second terminal anddeducting only from the at least one first memory section, the selectedamount of money; and providing an input memory in the data medium, inwhich data specifying an amount of money can be entered, and afterestablishing an operational connection between the data medium and thefirst terminal, displaying the amount of money specified in the inputmemory and, after a confirmation signal is supplied from the firstterminal, this amount of money is transferred from the second memorysection into the at least one or into a selected first memory section.5. A method as stated in claim 4, wherein after establishing anoperational connection between the data medium and the second terminal,and through the second terminal, a specific amount of money is writteninto the input memory.
 6. A method for paying for products includinggoods and services of vendors, by means of a portable data medium havinga memory with a plurality of memory sections, the methodcomprising:providing at least one first memory section and a secondmemory section for receiving data representing an amount of money;operatively connecting the data medium to a first terminal; using thefirst terminal to deduct, as a function of a first operation of thefirst terminal, a selected amount of money from the second memorysection and to write the selected amount into the at least one firstmemory section; and for receiving a product of a vendor, operativelyconnecting the data medium to a second terminal and deducting only fromthe at least one first memory section, the selected amount of money;providing a plurality of said first memory sections of which at leasttwo are respectively allocated to different vendors; selecting the firstmemory section into which amounts of money are written at a thirdterminal or when the data medium is connected to the first terminal;writing into at least one of the first memory sections, amounts of moneyin the form of data representing value units and for utilizing a productof a specific vendor through the second terminal, value units beinginvalidated in the first memory section allocated to the specific vendorin that corresponding data are altered; and storing in a third memorysection a transfer of data identifying value units, the vendor allocatedto the first memory section and a corresponding amount of money.
 7. Amethod for paying for products including goods and services of vendors,by means of a portable data medium having a memory with a plurality ofmemory sections, the method comprising:providing at least one firstmemory section and a second memory section for receiving datarepresenting an amount of money; operatively connecting the data mediumto a first terminal; using the first terminal to deduct, as a functionof a first operation of the first terminal, a selected amount of moneyfrom the second memory section and to write the selected amount into theat least one first memory section; and for receiving a product of avendor, operatively connecting the data medium to a second terminal anddeducting only from the at least one first memory section, the selectedamount of money; bring the data medium into operational connection witha third terminal in order to transfer through a first operation of thethird terminal, data representing an amount of money from the thirdterminal into the second memory section and corresponding data into acomputer connected with the third terminal, and, independently of theoperation of the third terminal, in order to read a contents of thethird memory section via the third terminal and transfer it to thecomputer; and through a second operation of the third terminal, datarepresenting an amount of money are transferred from the second memorysection, into a selectable first memory section and data identifyingsuch transfer are transferred via the third terminal to the computerconnected therewith.
 8. A method for paying for products including goodsand services of vendors, by means of a portable data medium having amemory with a plurality of memory sections, the methodcomprising:providing at least one first memory section and a secondmemory section for receiving data representing an amount of money;operatively connecting the data medium to a first terminal; using thefirst terminal to deduct, as a function of a first operation of thefirst terminal, a selected amount of money from the second memorysection and to write the selected amount into the at least one firstmemory section; and for receiving a product of a vendor, operativelyconnecting the data medium to a second terminal and deducting only fromthe at least one first memory section, the selected amount of money;bring the data medium into operational connection with a third terminalin order to transfer through a first operation of the third terminal,data representing an amount of money from the third terminal into thesecond memory section and corresponding data into a computer connectedwith the third terminal, and, independently of the operation of thethird terminal, in order to read a contents of the third memory sectionvia the third terminal and transfer it to the computer; and through athird operation of the third terminal the amount of money contained in afirst memory section are deducted and stored in a form of an amount ofmoney in the second memory section and data identifying this procedureare transferred via the third terminal to the computer connectedtherewith.
 9. A method for paying for products including goods andservices of vendors, by means of a portable data medium having a memorywith a plurality of memory sections, the method comprising:providing atleast one first memory section and a second memory section for receivingdata representing an amount of money; operatively connecting the datamedium to a first terminal; using the first terminal to deduct, as afunction of a first operation of the first terminal, a selected amountof money from the second memory section and to write the selected amountinto the at least one first memory section; and for receiving a productof a vendor, operatively connecting the data medium to a second terminaland deducting only from the at least one first memory section, theselected amount of money; bring the data medium into operationalconnection with a third terminal in order to transfer through a firstoperation of the third terminal, data representing an amount of moneyfrom the third terminal into the second memory section and correspondingdata into a computer connected with the third terminal, and,independently of the operation of the third terminal, in order to read acontents of the third memory section via the third terminal and transferit to the computer; and through a second operation of the first terminalan amount of money contained in a first memory section is deducted andstored in the second memory section and into the third memory sectiondata are written which identify this procedure.
 10. A method as statedin claim 9, wherein at least one of the first memory sections comprisesa further identifier which represents a date and which is updated withevery change of the contents of the particular first memory section andwhich, when the data medium is brought into operational connection witha third terminal, is compared with the current date, and, when aselected difference between the current date and the date according tothe further identifier is exceeded, the amount of money of theparticular first memory section is deducted and transferred into thesecond memory section and data identifying this transfer are transferredvia the third terminal to the computer connected therewith.
 11. A methodfor paying for products including goods and services of vendors, bymeans of a portable data medium having a memory with a plurality ofmemory sections, the method comprising:providing at least one firstmemory section and a second memory section for receiving datarepresenting an amount of money; operatively connecting the data mediumto a first terminal; using the first terminal to deduct, as a functionof a first operation of the first terminal, a selected amount of moneyfrom the second memory section and to write the selected amount into theat least one first memory section; and for receiving a product of avendor, operatively connecting the data medium to a second terminal anddeducting only from the at least one first memory section, the selectedamount of money; bring the data medium into operational connection witha third terminal in order to transfer through a first operation of thethird terminal, data representing an amount of money from the thirdterminal into the second memory section and corresponding data into acomputer connected with the third terminal, and, independently of theoperation of the third terminal, in order to read a contents of thethird memory section via the third terminal and transfer it to thecomputer; and at least one first memory section having one of severalidentifiers stored therein, which are assigned to various vendors of thesame type of products and, depending on the operation of the thirdterminal, a selected amount of money is deducted from the second memorysection and stored with the identifier in the first memory section anddata specifying this procedure is transferred via the third terminalinto the computer connected therewith.
 12. A method for paying forproducts including goods and services of vendors, by means of a portabledata medium having a memory with a plurality of memory sections, themethod comprising:providing at least one first memory section and asecond memory section for receiving data representing an amount ofmoney; operatively connecting the data medium to a first terminal; usingthe first terminal to deduct, as a function of a first operation of thefirst terminal, a selected amount of money from the second memorysection and to write the selected amount into the at least one firstmemory section; and for receiving a product of a vendor, operativelyconnecting the data medium to a second terminal and deducting only fromthe at least one first memory section, the selected amount of money; thestep of using the first terminal to deduct the selected amount of moneyfrom the second memory section and to write the selected amount of moneyinto the at least one first memory section operating to provisionallyallocate the selected amount of money to the at least one first memorysection; operatively connecting the data medium to a third terminal forcrediting the selected amount of money to a special vendor correspondingto the at least one first memory section; and after the crediting of theselected amount of money to the special vendor, releasing theprovisionally allocated amount of money in the at least one first memorysection for permitting the deducting of money from the at least onefirst memory section when the data medium is connected to a secondterminal corresponding to the special vendor.
 13. A system for securepayments to vendors, comprising:at least one portable data mediumincluding a control unit and a memory with a plurality of memorysections connected to the control unit, the memory sections including atleast one first memory section and only one second memory section; and aplurality of terminals each for connection to said data medium forexchanging information between said data medium and a terminal, theterminals including at least one first terminal which is equipped toconnect, during a first operation of the first terminal, to the controlunit of the data medium, to change data representing amounts of money inthe second memory section and in one of the first memory sections whichis related to the second memory during the first operation, theterminals including second terminals which are equipped to connect tothe control unit of the data medium to only change the data of the atleast one first memory section, without being capable of changing thedata of the second memory section; the data medium comprising an inputmemory and the first terminal being equipped to control the control unitof the data medium to transfer an amount of money corresponding tocontents of the input memory from the second memory section into theselected first memory section.
 14. A system for secure payments tovendors, comprising:at least one portable data medium including acontrol unit and a memory with a plurality of memory sections connectedto the control unit, the memory sections including at least one firstmemory section and only one second memory section; and a plurality ofterminals each for connection to said data medium for exchanginginformation between said data medium and a terminal, the terminalsincluding at least one first terminal which is equipped to connect,during a first operation of the first terminal, to the control unit ofthe data medium, to change data representing amounts of money in thesecond memory section and in one of the first memory sections which isrelated to the second memory during the first operation, the terminalsincluding second terminals which are equipped to control to the controlunit of the data medium to only change the data of the at least onefirst memory section, without being capable of changing the data of thesecond memory section; the memory of the data medium comprising severalfirst memory sections and each first terminal being equipped to write,as a function of an operation of the first terminal, into a firstselected memory section, a change of value units, the control unit ofthe data medium being equipped to write data identifying said changeinto a third memory section; and at least one second terminal beingequipped to change data only in a first memory section which isallocated to a particular vendor.
 15. A system as stated in claim 14,including a computer and at least one third terminal connected to thecomputer, the third terminal operating so that the data medium can beconnected thereto in order to control, during a first operation of thethird terminal, to the control unit of the data medium in order totransfer and write data representing amounts of money from the computerconnected to the third terminal, into the second memory section as wellas to transfer data from the third memory section into the computer. 16.A system as stated in claim 15, wherein, during a second operation ofthe third terminal the control unit of the data medium is controlled tochange data in the second memory section and in a selected first memorysection related to the second memory section, and to transfer dataspecifying this change via the third terminal into the computerconnected to the third terminal.
 17. A system as stated in claim 15,wherein, during a second operation of the third terminal, the controlunit of the data medium is triggered to change mutually dependent datain the second memory section and in a selected first memory section andto transfer data specifying this change via the third terminal into thecomputer connected to the third terminal.
 18. A portable data medium fora system and method for secure payments to vendors, comprising:a controlunit; a memory with at least one first memory section and only onesecond memory section connected to the control units; an interface tothe outside which is coupled with the memory and with the control unitin order to supply data representing amounts of money to the memory andto supply control commands to the control unit; the control unit beingequipped, upon receiving a first control command, to change datarepresenting amounts of money only in a first memory section, and uponreceiving a second control command, to deduct data representing amountsof money from the second memory section and to write them into a firstmemory section, the control unit being equipped so that upon receiving athird control command from the interface, the control unit writes datarepresenting amounts of money and supplied via the interface, into thesecond memory section; and an input memory for receiving data specifyingan amount of money, the control unit being equipped to deduct, uponbeing supplied with the second control commands, data corresponding tothe contents of the input memory from the second memory section and towrite them into one of the first memory sections.
 19. A portable datamedium for a system and method for secure payments to vendors,comprising:a control unit; a memory with at least one first memorysection and only one second memory section connected to the controlunits; an interface to the outside which is coupled with the memory andwith the control unit in order to supply data representing amounts ofmoney to the memory and to supply control commands to the control unit;the control unit being equipped, upon receiving a first control command,to change data representing amounts of money only in a first memorysection, and upon receiving a second control command, to deduct datarepresenting amounts of money from the second memory section and towrite them into a first memory section, the control unit being equippedso that upon receiving a third control command from the interface, thecontrol unit writes data representing amounts of money and supplied viathe interface, into the second memory section; and wherein the memorycomprises several first memory sections and a third memory section andthe control unit equipped to change data in a first memory sectionselected by the first control command and to write data representingvalue units into a first memory section selected by the second controlcommand and to write data identifying this procedure as a function ofthe second control commands into the third memory section or to outputthem via the interface, and, upon being supplied with a fourth controlcommand, to read the data from the third memory section and output thedata via the interface.
 20. A portable data medium as stated in claim19, wherein the control unit is equipped to deduct, upon being suppliedwith a fifth control command, value units in a first memory sectionselected by the fifth control command and to write data representing anamount of money into the second memory section and to write dataidentifying this procedure as a function of the fifth control commandinto the third memory section or to output them via the interface.